CVE-2020-28487

MEDIUM

vis-timeline < 7.4.4 - Cross-Site Scripting via Timeline Items

Title source: llm
STIX 2.1

Description

This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application.

References (5)

Core 5
Core References
Exploit, Patch, Third Party Advisory x_refsource_misc
https://snyk.io/vuln/SNYK-JS-VISTIMELINE-1063500
Exploit, Patch, Third Party Advisory x_refsource_misc
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1063501
Exploit, Patch, Third Party Advisory x_refsource_misc
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBVISJS-1063502
Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/visjs/vis-timeline/issues/838
Patch, Third Party Advisory x_refsource_misc
https://github.com/visjs/vis-timeline/pull/840

Scores

CVSS v3 6.8
EPSS 0.0144
EPSS Percentile 70.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

Details

CWE
CWE-79
Status published
Products (2)
npm/vis-timeline 0 - 7.4.4npm
visjs/vis-timeline < 7.4.4
Published Jan 22, 2021
Tracked Since Feb 18, 2026